*1 1. Pending before the Special Master is Plaintiffs’ Motion to Compel Production of Documents Related to Protiviti's Assessments Pursuant to the FTC Consent Order.

2. In 2011, Facebook agreed to settle FTC charges related to deceptive privacy settings on the Facebook platform and disclosure of user data without user consent. See In the Matter of Facebook, Inc. Complaint and Agreement Containing Consent Order. The consent order required Facebook to retain an independent third party to conduct assessments regarding Facebook's privacy controls and their effectiveness. See Agreement Containing Consent Order § V. PwC was retained as the independent assessor pursuant to the Agreement Containing Consent Order and Facebook has produced documents in connection with those assessments.

3. In 2019, the FTC filed a new complaint alleging Facebook violated the 2012 consent order. See July 24, 2019 Complaint. On April 27, 2020, the FTC entered the Order Modifying Prior Decision and Order (“Modified Consent Order”) which required Facebook to “establish and implement, and thereafter maintain a comprehensive privacy program (“Privacy Program”) that protects the privacy, confidentiality, and Integrity of the Covered Information collected, used, or shared by Respondent.” See Modified Consent Order § VII. The Modified Consent Order also required a third party to provide independent assessments of the privacy program implemented pursuant to § VII of the Modified Consent Order. See Modified Consent Order § VIII.

4. On June 22, 2020 Protiviti was retained as the independent assessor of Facebook's privacy program. Protiviti's initial assessment concerned the first six months following the implementation of Facebook's Privacy Program—October 2020 to April 2021. See Protiviti Submission to Special Master.

5. As Protiviti stated in its initial assessment, Facebook had the option after the Modified Consent Order of either “renovating its existing programs and Safeguards [from the 2012 Order] to conform to the new requirements imposed by the 2020 Order” or, “in recognition of the significant degree of change expected by the [2020] Order,” creating “an entirely new program.” See Protiviti Submission to Special Master, Ex. D. at 6. Facebook “elected the latter option” and “comprehensively redesign[ed] the privacy organizational structure, program materials, and Safeguards.” Id. Protiviti assessed Facebook's redesigned privacy program implemented pursuant to the Modified Consent Order.

6. Plaintiffs’ Motion seeks documents from Facebook related to Protiviti's assessments. Plaintiffs argue that Facebook should be compelled to produce these documents because Protiviti's assessments are relevant to Plaintiffs’ allegations that Facebook gave app developers access to restricted user information, continued to disclose restricted user information to whitelisted apps, shared restricted user data with partners, and failed to restrict third-party use of restricted user information. Plaintiffs argue that Protiviti's assessments are relevant to the class period because the continued existence of “gaps and weaknesses” in Facebook's privacy program identified by Protiviti indicate that privacy issues had not been addressed at an earlier time, including the time period relevant to this case. See Motion at 3.

*2 7. Facebook argues that Protiviti's assessments and related documents are not relevant because they concern the privacy program Facebook implemented after the conduct at issue in this case occurred, between “roughly 2009 and 2015.” See Dkt. 298, at 2-3, 22. Facebook further argues that the burden of producing the Protiviti documents outweighs any probative value they might have as Plaintiffs’ demand “would require collection and review of potentially millions of documents from hundreds of custodians (including dozens of attorneys) who have worked with Protiviti on the initial and ongoing assessment, as well as a massive privilege review.” See Facebook's Letter Brief at 3 (“Protiviti's initial assessment alone involved more than 120 auditors working with hundreds of Facebook employees over three months, including communications related to 3,000 information requests and more than 500 interviews and process walkthroughs.”). Additionally, Facebook argues that Facebook has already produced the assessments conducted by PwC from the relevant time period.

8. Special Master Garrie finds, based on a proportionality analysis, that the burden of producing the Protiviti assessments and related documents outweighs any probative value such documents may have. See Fed. R. Civ. P. 26(b)(1) (Discovery should be denied where its “burden or expense ... outweighs its likely benefit.”). Special Master Garrie finds the volume of documents, communications, and custodians related to the Protiviti assessments, as represented by Facebook, indicate that production of these materials would require a substantial amount of time and money. Special Master Garrie finds that the Protiviti assessments and related documents are unlikely to have much if any probative value to this matter because the assessments concern a new, redesigned privacy policy that Facebook implemented in 2020, years after the relevant time period for this matter. Special Master Garrie finds that to the extent that Protiviti's assessments identified “gaps and weaknesses” in Facebook's privacy policy as of 2020, this is unlikely to provide additional information not contained the assessments PwC conducted during the relevant time period, which Facebook has produced.

9. Plaintiffs’ Motion is denied.

IT IS SO ORDERED.